Senior SIEM/SOAR Engineer (Elastic & Splunk)

BreakPoint Labs LLC; Charleston, Northern (SC, KY); Hybrid; USD 90,000 - 130,000; Full time

Job summary

BreakPoint Labs LLC is seeking a SIEM/SOAR Engineer to manage and maintain the CSSP’s SIEM and SOAR platforms, including Elastic and Splunk. The role focuses on reliability, performance, and security of enterprise systems and data ingestion pipelines.

Requirements include 3+ years managing Elastic clusters, Elasticsearch Enterprise (Logstash/Kibana), DoD 8570 IAT Level II, CSSP Auditor compliance, and strong Python/PowerShell scripting. RHEL Linux expertise and team collaboration are essential.

Qualifications

• Minimum of 3 years maintaining an enterprise Elastic cluster.
• Experience with Elasticsearch Enterprise (Logstash/Kibana) for SIEM operations.
• DoD 8570 IAT Level II and CSSP Auditor compliant certification.
• Bachelor’s Degree in related field.
• Strong scripting in Python or PowerShell for automation.
• Experience with threat detection and incident response processes.
• Extensive Linux (RHEL) administration experience.
• Ability to collaborate in a team and on-call rotation.

Responsibilities

• Design, implement, and maintain SIEM and SOAR infrastructure (Elastic and Splunk).
• Manage enterprise Elastic cluster to support CSSP SIEM operations.
• Monitor and analyze security events to protect assets.
• Develop and maintain use cases, rules, and alerts for threat detection.
• Integrate SIEM/SOAR with other security tools and data sources.
• Automate security workflows and incident response using SOAR platforms.
• Perform health checks, tuning, and capacity planning for SIEM/SOAR.
• Manage data ingestion pipelines for security events.
• Update, patch, and upgrade SIEM/SOAR systems regularly.
• Create documentation for configurations and SOPs.
• Collaborate with analysts and other CSSP teams on tool usage.

Skills

SIEM/SOAR operations

Elastic cluster

Python/PowerShell scripting

Linux administration

Education

Bachelor's degree in related field

Tools

Elasticsearch Enterprise (Logstash/Kibana)

Splunk

Job description

BreakPoint Labs LLC is seeking a SIEM/SOAR Engineer to manage and maintain the CSSP’s SIEM and SOAR platforms, including Elastic and Splunk. The role focuses on reliability, performance, and security of enterprise systems and data ingestion pipelines.

Requirements include 3+ years managing Elastic clusters, Elasticsearch Enterprise (Logstash/Kibana), DoD 8570 IAT Level II, CSSP Auditor compliance, and strong Python/PowerShell scripting. RHEL Linux expertise and team collaboration are essential.